* fix(security): ADR-165 Phase 1 — close all critical CVEs, refresh registry, add CI gate
Closes ADR-165 Phase 1. Both workspaces pass `npm audit --audit-level=critical`.
## Before (2026-06-29)
| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root | **1** | 6 | 31 | 38 |
| v3 | **4** | 33 | 57 | 97 |
## After
| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root | **0** | 0 | 31 | 31 |
| v3 | **0** | 27 | 58 | 88 |
All 5 critical advisories closed (vitest GHSA-5xrq, handlebars prototype-pollution,
protobufjs constructor-pollution, plus 2 more in v3). 12 of 39 high advisories
closed via overrides; the remaining 27 v3 highs are deeper transitive chains
that would require breaking-change major bumps — flagged for ADR-165 Phase 2.
## Changes
### Root workspace overrides (package.json)
- `vitest`: `^1.0.0` → `^3.2.6` (closes critical GHSA-5xrq CVSS 9.8)
- `hono`: `>=4.11.4` → `>=4.12.25` (closes 6 hono advisories)
- `undici`: `>=7.18.0` → `>=8.5.0` (closes 7 undici advisories — bumps the
stale pin that ADR-165 flagged as still-in-vulnerable-range)
- `vite`: `>=6.4.6` → `>=8.0.16` (closes 2 vite advisories)
- NEW `@grpc/grpc-js`: `>=1.14.4`
- NEW `form-data`: `>=4.0.6`
- NEW `http-proxy-middleware`: `>=3.0.7`
- `@hono/node-server`: `>=1.19.10` → `>=1.19.14`
### v3 workspace overrides (v3/package.json + pnpm.overrides)
- `vitest`: `^4.0.16` → `^4.1.0` (and `@vitest/coverage-v8` matched)
- Top-level + pnpm overrides: `handlebars: >=4.7.9`, `protobufjs: >=8.6.0`
- 27 sub-package `package.json` updated to `vitest ^4.1.0`
### CVE registry refresh (v3/@claude-flow/security/src/CVE-REMEDIATION.ts)
Rewritten from 5 stale Jan-2026 entries to 16 total: 15 fixed, 1 open
(ADR165-OPEN-01 — PII pipeline wiring per ADR-164 §6.1 not yet on
dispatch-layer). `SECURITY_SUMMARY` is now computed dynamically from the
registry; `validateRemediation()` correctly returns `allFixed: false`
with 1 issue. ADR-165 §5 flagged this as THE Phase 2 priority — now closed.
### New CI gate
`.github/workflows/cve-audit.yml`:
- `audit-root` — `npm audit --audit-level=critical` in root, blocking
- `audit-v3` — same in v3, blocking
- `audit-high-report` — warn-only summary on high-severity drift
- Triggers: PR, push to main, daily cron
### ADR-165 §9 evidence ledger addendum
Captures AFTER-remediation `npm audit --json` metadata for both workspaces.
The diff between BEFORE (already in §9) and AFTER makes Phase 1 verifiable.
Also CORRECTED one prior surprise in §9: the `validate-input.ts` in
`mcp-tools/` is NOT a 9-line shim. It's 269 lines of real implementation.
(That was an inaccurate findings note from the initial audit.)
### §7.3 research items resolved
- `protobufjs` v3 chain confirmed gone after override pins
- `handlebars` v3 chain confirmed not user-reachable on the workflow path
(toolchain-only; override sufficient)
- `validate-input.ts` confirmed real implementation, not a shim (registry
entry corrected)
- CORS surface check: no `cors()` / `app.use(cors` call sites — the hono
CORS-wildcard advisory is not exploitable on the current server
- ADR-164 §6.1 PII pipeline NOT wired in current agentbbs dispatch —
recorded as ADR165-OPEN-01 (Phase 3 work)
## Gates (all PASS)
- `npm audit --audit-level=critical` root: exit 0 (was non-zero)
- `npm audit --audit-level=critical` v3: exit 0 (was non-zero)
- vitest suites: 105/109 pass (4 skip-conditional — same as before)
- ADR-112 audit: 352/352 tools with guidance
- business-pods smoke: 11/11 PASS
- agentbbs smoke: 8/8 PASS
- agenticow smoke: 8/8 PASS
- cli build: clean (tsc)
## Phase 2+ deferred
The 27 v3 high-severity advisories that remain are transitive chains with
no patched-in-range version. ADR-165 §6 Phase 2 picks these up after the
`cve-watch.yml` automation in §6 lands (NEW PR — not in scope here).
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01WbBa4nccx5aGhXphoHxcni
* chore(lock): regen v3/pnpm-lock.yaml after override updates (PR #2508 CI fix)
PR #2508 added handlebars + protobufjs to v3 overrides + bumped vitest pin,
but v3/pnpm-lock.yaml wasn't regenerated. CI surfaced
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every install step.
Same pattern as the previous lockfile-drift fixes on PR #2500 and #2503.
* fix(ci): cve-audit.yml jq-only + regen witness manifests for #1609 marker drift
Two PR #2508 CI failures fixed:
1. Static-regression-guard tripped on cve-audit.yml line 52: the static
YAML strict-parser sees `if high > 0:` inside the `run: |` block as
a YAML block-mapping key indicator. Refactored all 3 inline-python
blocks to use jq (preinstalled on ubuntu-latest) — no embedded
`if x > 0:` lines, so the YAML guard passes.
2. Witness marker drift smoke flagged fix-marker #1609 — the Phase 1
vitest bump (4.0.16 → 4.1.0) drifted the cited marker string in
v3/@claude-flow/aidefence/package.json. Updated `marker` field in
all 3 platform manifests + `desc` to reference ADR-165 Phase 1, then
re-signed via plugins/ruflo-core/scripts/witness/regen.mjs.
Co-Authored-By: RuFlo <ruv@ruv.net>
This commit closes the chain started in ca0a6fa5c (standalone use recipes
landed in repo but never reached npm because no version bumps shipped).
## Changes
### Module version bumps (alpha.43)
- @claude-flow/memory → 3.0.0-alpha.17 (republish standalone use README)
- @claude-flow/embeddings → 3.0.0-alpha.18 (republish standalone use README)
- @claude-flow/security → 3.0.0-alpha.8 (republish standalone use README)
- @claude-flow/neural → 3.0.0-alpha.9 (pin @ruvector/sona to 0.1.5,
republish standalone use README)
- @claude-flow/cli → 3.7.0-alpha.43 (repin to new modules above)
- claude-flow → 3.7.0-alpha.43 (umbrella)
- ruflo → 3.7.0-alpha.43 (umbrella)
### Umbrella bump (alpha.44) — npm download badges
- @claude-flow/cli → 3.7.0-alpha.44
- claude-flow → 3.7.0-alpha.44
- ruflo → 3.7.0-alpha.44
### Neural sona pin (root fix for #2022)
@claude-flow/neural alpha.8 had `"@ruvector/sona": "latest"`, and
@ruvector/sona@0.1.6 (current latest on npm) shipped as an empty publish
— README + package.json only, no index.js or native bins. So every
fresh `npm install @claude-flow/neural@alpha.8` broke at import time
with `Cannot find package '.../node_modules/@ruvector/sona/index.js'`.
Alpha.9 pins to the exact known-good 0.1.5 (which has index.js + 7
platform-specific .node bins). Will revert to a range once
@ruvector/sona@0.1.7+ ships with content (tracked in #2022).
### npm download badges across every published package README
Added `shields.io/npm/dm/<pkg>` (monthly downloads) badges to:
- claims, cli-core, plugins (had no npm badges at all)
- plugin-agent-federation, plugin-iot-cognitum (no npm badges)
- browser, codex, mcp (had version badge, missing downloads)
- umbrella root README (now badges both `ruflo` + `claude-flow`)
The ruflo/README.md and v3/@claude-flow/cli/README.md auto-copy from
root via prepublishOnly, so they inherit the new badges on publish.
Packages that already carried downloads badges (aidefence, deployment,
embeddings, guidance, hooks, integration, memory, neural, performance,
providers, security, shared, swarm, testing) are unchanged.
## Live functional check on the published artifacts
- Fresh `npm install @claude-flow/neural@3.0.0-alpha.9`:
sona resolves to 0.1.5; `import('@claude-flow/neural')` returns
A2CAlgorithm, BalancedMode, BaseModeImplementation, BatchMode,
CuriosityModule, ... (was broken before alpha.9).
- Standalone use sections from ca0a6fa5c now visible on npmjs.com for
memory@alpha.17, embeddings@alpha.18, security@alpha.8, neural@alpha.9.
- npm dm/ badges resolve and render the current weekly download count.
Co-Authored-By: RuFlo <ruv@ruv.net>
Same failure shape as #1147: `npx @claude-flow/cli@latest` crashes with
`npm error Invalid Version: ` on npm 11.x / Node 24+.
Root cause: @claude-flow/embeddings declared @huggingface/transformers in
both `optionalDependencies` AND `peerDependencies` (with
peerDependenciesMeta.optional = true). When npm 11.x arborist runs
PlaceDep.pruneDedupable → Node.canDedupe → semver.eq, the overlap plus a
"-dev." prerelease transitive (onnxruntime-web@1.26.0-dev.…) trips the
empty-version crash inside @npmcli/arborist.
Fix:
- @claude-flow/embeddings: keep only the optional peerDependency, drop
the duplicate optionalDependencies entry. Bumped to 3.0.0-alpha.17.
- @claude-flow/cli: pin embeddings to ^3.0.0-alpha.17 so existing
lockfiles re-resolve to the fixed version. Bumped to 3.7.0-alpha.39.
Regression guards (so this can't recur):
- scripts/audit-package-dep-overlap.mjs — static check that no package
declares the same name in BOTH optionalDependencies and
peerDependencies. Wired into v3-ci.yml as part of the
plugin-package-audit job.
- scripts/smoke-cli-npx-install.mjs — behavioural smoke: pack the CLI
tarball, install it into a scratch project with optionals enabled,
fail if `npm install` prints "Invalid Version:" or exits non-zero.
New v3-ci.yml job `cli-npx-install-smoke` runs on Node 22 + 24
(Node 24 ships npm 11.x, where the bug surfaces) and gates witness-verify.
Verified end-to-end:
$ npx -y @claude-flow/cli@3.7.0-alpha.39 doctor
✓ MCP Servers, AIDefence, Disk Space, TypeScript … 10 passed
Closes#1468.
`downloadEmbeddingModel`'s catch regex only matched
`Cannot find package` / `Cannot find module`. On Windows + Node strict
ESM, the bundled `agentic-flow`'s `package.json` doesn't declare a
`./embeddings` subpath, which raises a different shape:
Package subpath './embeddings' is not defined by "exports" in
C:\...\node_modules\agentic-flow\package.json
That message didn't match either branch of the existing regex, so the
error re-threw all the way up to `ruflo embeddings init` and broke the
init flow on Windows even though the rest of the embedding pipeline
(@xenova/transformers ONNX) doesn't actually need agentic-flow.
Fix: extend the regex to also catch:
- `Package subpath '\./embeddings' is not defined`
- `ERR_PACKAGE_PATH_NOT_EXPORTED`
When matched, falls back to the same lazy-fetch path as the missing-
package case — model downloads on first generate via @xenova.
The other three `import('agentic-flow/embeddings')` sites in this file
(init, isNeuralAvailable, listEmbeddingModels) already wrap their
imports in try/catch that returns a neutral value, so they degrade
gracefully on this same error.
Verified the new regex matches the Windows error string exactly.
WSL/Linux behavior unchanged (those resolve agentic-flow successfully).
Published @claude-flow/embeddings@3.0.0-alpha.16 (alpha + latest tags).
The cli's optional-dep range `^3.0.0-alpha.12` resolves to alpha.16 for
fresh installs, so `npx ruflo@latest embeddings init` picks up the fix
without a cli/umbrella republish.
Co-Authored-By: RuFlo <ruv@ruv.net>
Batched publish of iteration #11 (suppression-via-side-effect-module),
iteration #14 (ADR-094 transformers loader: try-prefer
@huggingface/transformers, fall back to @xenova).
Verified in clean smoke install:
- `ruflo --version` clean (no [AgentDB Patch] noise)
- `memory init --force` clean
- transformers-loader.js shipped in @claude-flow/embeddings dist
- ADR-094 inline logic shipped in cli memory-initializer.js
The protobufjs <7.5.5 CVE chain still shows in npm audit because
@huggingface/transformers is an OPTIONAL dep — users opt in via
`npm install @huggingface/transformers` and the loader picks it up.
Once installed, the legacy chain drops and audit clears.
Co-Authored-By: RuFlo <ruv@ruv.net>
ADR-094 — transformers loader (try-prefer-fallback):
- New v3/@claude-flow/embeddings/src/transformers-loader.ts exposes
loadTransformersPipeline() that prefers @huggingface/transformers
(clears protobufjs <7.5.5 critical RCE chain), falls back to legacy
@xenova/transformers for backwards compat. Caches the resolved
source so repeated callers don't re-import.
- Updated v3/@claude-flow/embeddings/src/embedding-service.ts:387 to
use the loader instead of direct @xenova import.
- Updated v3/@claude-flow/cli/src/memory/memory-initializer.ts:1539
with inlined try-prefer-fallback (avoids circular optional-dep at
install time).
- v3/@claude-flow/embeddings/package.json: added @huggingface/transformers
to optionalDependencies (^4.2.0) and peerDependenciesMeta.optional.
Both packages build clean. The loader uses a string-variable specifier
in dynamic import so tsc doesn't try to resolve types at compile time
(both packages are runtime-optional).
ADR-095 — architectural gap tracking from April audit (@roman-rr):
- Documents the 7 gaps the May audit/ADR-093 honesty work didn't
address: G1 agent_spawn no subprocess, G2 single-process consensus,
G3 workflow runtime missing, G4 WASM echo stub, G5 transformers
CVE chain (now ADR-094), G6 auto-memory graph 100MB bloat for 20
unique entries, G7 6 disabled AgentDB controllers.
- Reserves ADR-096..ADR-107 numbers for the per-gap follow-up ADRs.
- Explicit "tracking only — no decisions" status so gaps don't dilute
through the issue tracker.
Co-Authored-By: RuFlo <ruv@ruv.net>
Regression caught by 3.6.15 smoke test: with agentic-flow auto-installed
as an optional dep, `import('agentic-flow/embeddings')` succeeds but
the loaded module exposes `clearEmbeddingCache`/`computeEmbedding`/
`computeEmbeddingBatch`/`getEmbeddingDimensions` — no `downloadModel`.
3.0.0-alpha.13 only handled the "package missing" path. With agentic-
flow present but the function absent, it threw `downloadModel is not a
function` straight up to the CLI's `embeddings init` action, which
reported `[ERROR] Initialization failed: downloadModel is not a function`.
3.0.0-alpha.14 checks `typeof downloadFn === 'function'` before
calling and falls through to the same lazy-fetch warning otherwise.
@xenova/transformers downloads on first generate() either way.
Verified in clean smoke install with cache cleaned:
$ ruflo embeddings init --force
Initialize Embedding Subsystem
...
Next steps:
- embeddings generate -t "test text" - Test embedding generation
...
Co-Authored-By: RuFlo <ruv@ruv.net>
#1700 item 2: `embeddings init` failed with `Cannot find package
'agentic-flow'` because downloadEmbeddingModel did not catch the dynamic
import error, even though agentic-flow is declared as an optional peer.
Now logs an informative warning and returns the target dir as a no-op
success — @xenova/transformers fetches the model lazily on first
embeddings_generate call.
Bumps @claude-flow/embeddings to 3.0.0-alpha.13. ruflo@3.6.14 picks it
up automatically via caret range.
Verified in clean /tmp install:
$ node -e "import('@claude-flow/embeddings').then(m =>
m.downloadEmbeddingModel('Xenova/all-MiniLM-L6-v2', '/tmp/test-models'))"
[embeddings] agentic-flow not installed — skipping eager model download.
Models will be fetched lazily by @xenova/transformers on first generate.
downloadEmbeddingModel returned: "/tmp/test-models"
PASS — graceful fallback worked
Previously this threw "Cannot find package 'agentic-flow' imported from
.../@claude-flow/embeddings/dist/neural-integration.js".
Co-Authored-By: RuFlo <ruv@ruv.net>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T19:04:42Z
- Changes: 19 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T05:06:13Z
- Changes: 3 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T05:05:42Z
- Changes: 1 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T05:05:41Z
- Changes: 1 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T05:02:15Z
- Changes: 1 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T05:02:14Z
- Changes: 6 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:27:42Z
- Changes: 2 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:16:55Z
- Changes: 2 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:12:36Z
- Changes: 1 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:12:19Z
- Changes: 1 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:11:00Z
- Changes: 6 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Automatic checkpoint created by Claude Code
- Branch: v3
- Timestamp: 2026-01-07T04:10:59Z
- Changes: 4 file(s)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Updated standard-checkpoint-hooks.sh to accept both JSON and plain paths
- Fixed pre-edit and post-edit functions to detect input format
- Fixed v3 CLI hook flags (-f -> --file, -c -> --command, etc.)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
rUv